CVE-2026-13887: Chrome Android NFC Data Leak Vulnerability

CVE-2026-13887 Overview

CVE-2026-13887 is an inappropriate implementation vulnerability in the Near Field Communication (NFC) component of Google Chrome on Android. The flaw exists in versions prior to 150.0.7871.47. A remote attacker who has already compromised the renderer process can leak cross-origin data through a crafted HTML page. The Chromium project rated the security severity as Medium. The weakness is classified under CWE-346: Origin Validation Error, reflecting improper enforcement of the same-origin policy across NFC interactions.

Critical Impact
An attacker with a compromised renderer can bypass origin boundaries and read data belonging to other web origins on Android devices running vulnerable Chrome builds.

Affected Products

Google Chrome on Android prior to version 150.0.7871.47
Chromium-based mobile browsers that inherit the vulnerable NFC implementation
Android applications embedding vulnerable Chrome WebView builds

Discovery Timeline

2026-06-30 - CVE-2026-13887 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13887

Vulnerability Analysis

The defect resides in Chrome's Android NFC implementation. Chrome exposes NFC read and write functionality to web content through the Web NFC API. This API must enforce strict origin boundaries so that data associated with one origin cannot be observed by another. The implementation fails to fully validate origin context during NFC data handling. As a result, an attacker who already controls a compromised renderer process can craft an HTML page that leaks data belonging to other origins. Exploitation requires user interaction, consistent with NFC usage patterns that involve tapping or proximity to an NFC target.

Root Cause

The root cause is an origin validation error [CWE-346] in the NFC subsystem. The code path handling NFC events does not correctly bind data to the requesting origin. This allows a malicious renderer to receive or infer data intended for a different origin. The design assumption that the renderer would always operate within its own security context breaks down once the renderer itself is compromised through a prior exploit.

Attack Vector

Exploitation chains this issue with a prior renderer compromise, typically achieved through a separate memory corruption or logic bug in Chrome. Once the renderer is under attacker control, the attacker navigates the browser to a crafted HTML page that abuses the Web NFC interface. The page triggers NFC operations and extracts cross-origin data. The attack is network-reachable because the malicious page can be served remotely, though physical proximity to an NFC tag or device may influence which data is exposed.

Refer to the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for vendor-provided technical context.

Detection Methods for CVE-2026-13887

Indicators of Compromise

Android devices running Chrome versions earlier than 150.0.7871.47 that access untrusted web pages requesting NFC permissions.
Unexpected Web NFC permission prompts on pages unrelated to legitimate NFC workflows.
Renderer process crashes or anomalies preceding NFC activity, which may indicate a chained renderer exploit.

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets and flag builds below 150.0.7871.47.
Inspect mobile browser telemetry for pages invoking navigator.nfc or the Web NFC reader interfaces from low-reputation domains.
Correlate renderer compromise indicators, such as Chrome sandbox violations, with subsequent NFC API usage within short time windows.

Monitoring Recommendations

Enable mobile threat monitoring on managed Android devices to record browser version state and web permission grants.
Log DNS and HTTP proxy activity for connections to domains serving pages that request NFC access.
Alert on installations of outdated Chrome APKs delivered outside of the Google Play update channel.

How to Mitigate CVE-2026-13887

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store.
Force-update managed Android devices using enterprise mobility management (EMM) or mobile device management (MDM) policies.
Restrict Web NFC permissions on corporate-managed browsers until updates are confirmed deployed.

Patch Information

Google addressed the flaw in Chrome for Android 150.0.7871.47. Details are documented in the Google Chrome Desktop Update release note and the Chromium Issue Tracker Entry. Deploy the update through Google Play or managed application distribution channels.

Workarounds

Disable NFC on Android devices that do not require it for business functions until Chrome is patched.
Configure browser policy to deny the nfc permission by default through Chrome enterprise policies.
Block access to untrusted web content on mobile devices using DNS filtering or secure web gateways.

bash

# Chrome Enterprise policy example to disable NFC access by default on Android
{
  "DefaultSensorsSetting": 2,
  "SensorsBlockedForUrls": ["*"],
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://*.corp.example.com"]
}